[TOC]
需要准备的安装包：
1）jdk
2）elasticsearch
3）filebeat
4）kibana
5）kafka
6）logstash
安装前的准备：
关闭防火墙、selinux：
systemctl stop firewalld
systemctl disable firewalld
sed -i``'s/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
Linux系统参数优化：
1. /etc/security/limits.conf 添加如下几行：
elasticsearch - nofile 65536
elasticsearch - nproc 65536
2. /etc/sysctl.conf 添加如下几行：
vm.zone_reclaim_mode=0
vm.max_map_count = 262144
vm.swappiness = 1
1. 从ES官网下载最新的elasticsearch tar包：
ES 官网：https://www.elastic.co/downloads/elasticsearch
tar包：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.3.tar.gz
<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.3.tar.gz</pre></wiz_code_mirror>
2. 解压tar包：
<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">tar -zxvf elasticsearch-5.6.3.tar.gz</pre></wiz_code_mirror>
**# 3. !!! 注意：如果是用root账号启动，会报以下错误 **
<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root. at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:93) at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:144) at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:285) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35) Refer to the log for complete error details.</pre></wiz_code_mirror>
出于系统安全考虑设置的条件。由于ElasticSearch可以接收用户输入的脚本并且执行，为了系统安全考虑，
建议创建一个单独的用户用来运行ElasticSearch。
（1）创建elsearch用户组及elsearch用户：
<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">groupadd elsearch</pre>
<pre class=" CodeMirror-line " role="presentation">useradd elsearch -g elsearch -p elasticsearch</pre></wiz_code_mirror>
（2）更改elasticsearch文件夹及内部文件的所属用户及组为elsearch:elsearch：
<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">chown -R elsearch:elsearch elasticsearch-5.6.3</pre></wiz_code_mirror>
4. 启动 elsearch 服务：（-d:后台启动）
<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">./bin/elasticsearch -d</pre></wiz_code_mirror>
5. 测试ES是否启动成功：
<wiz_code_mirror><pre class=" CodeMirror-line " role="presentation">curl 'http://localhost:9200/?pretty'</pre></wiz_code_mirror>
正确的返回结果：
{
"name" : "ben-es-2",
"cluster_name" : "ben-es",
"cluster_uuid" : "ydRmxXuMSF-ScokWulAq9w",
"version" : {
"number" : "6.6.0",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "a9861f4",
"build_date" : "2019-01-24T11:27:09.439740Z",
"build_snapshot" : false,
"lucene_version" : "7.6.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
6. 修改config/elasticsearch.yml配置文件
修改network.host的值：
<meta charset="utf-8">
默认情况下，Elastic 只允许本机访问，如果需要远程访问，可以修改 Elastic 安装目录的config/elasticsearch.yml文件，去掉network.host的注释，将它的值改成0.0.0.0，然后重新启动 Elastic。
network.host: 0.0.0.0
上面代码中，设成0.0.0.0让任何人都可以访问。线上服务不要这样设置，要设成具体的 IP。
